Removal of code signing trust bits from ca-certificates
Until recently, Mozilla maintained three individual trust bits for each root CA
certificate:
- trust for TLS servers
- trust for email security
- trust for code signing
The next CA update from Mozilla will switch the code signing trust bit
OFF for all CAs.
Mozilla will no longer maintain this trust bit.
See
https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/004uv...
for background.
I'm not aware of anyone using this trust bit. The removal might have no effect.
This update of the CA list is supposed to get published with Firefox 56 on
September 26.
In order to allow the Fedora community to test potential effects of this change,
I intend to publish an update to the ca-certificates packages early, and keep it
in updates-testing for a few weeks.
Tracking bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1472468
Thanks
Kai